IcedIDMalware
- bokbot
- iceid
According to Proofpoint, IcedID (aka BokBot) is a malware originally classified as a banking malware and was first observed in 2017. It also acts as a loader for other malware, including ransomware. The well-known IcedID version consists of an initial loader which contacts a Loader C2 server, downloads the standard DLL Loader, which then delivers the standard IcedID Bot.From MISP Galaxy
Last reported 4 months ago, by Sekoia.io7 reports
ATT&CK techniques
6 of 68 · each with the sentence it comes from- T1053.005Scheduled Task
“Usually the threat actors try to deploy ransomware as widely as possible, and use PsExec or Group Policy modification to run a scheduled task to run it.”
- T1021.001Remote Desktop Protocol
“In addition, lateral movement was enabled by leveraging Remote Desktop Protocol.”
- T1033System Owner/User Discovery
“DiscoveryT1033 – System Owner/User Discovery”
- T1036Masquerading
“…t operator regularly changed the impersonated brands to evade detection from cybersecurity vendors, and eventually realised that this masquerading technique was not effective.”
- T1055Process Injection
“Privilege EscalationT1055.002 – Process Injection: Portable Executable Injection”
- T1059.003Windows Command Shell
“ExecutionT1059.003 – Command and Scripting Interpreter: Windows Command Shell”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
7 reports, newest first · the exact sentence from each-
PikaBot: a Guide to its Deep Secrets and Operations“…conducted the Operation Endgame to disrupt criminal services, notably through taking down key botnet infrastructures, including those of IcedID, SystemBC, PikaBot, SmokeLoader and BumbleBee.”
-
From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion“…wnloader first identified by Proofpoint researchers in November 2023, is attributed to the same threat actors responsible for developing IcedID.”
-
Ransomware manager: Investigation into farnetwork, a threat actor linked to five strains of ransomware“… public reports, the threat actors requested a ransom of $200,000 in Bitcoin The same report also revealed that Nokoyawa operators used IcedID malware and tools such as PsExec, AdFind, and Cobalt Strike.”
-
Dusting for fingerprints: ShadowSyndicate, a new RaaS player?“In its attacks, ShadowSyndicate used an “off-the-shelf” toolkit, including Cobalt Strike, IcedID, and Sliver malware.”
-
Prometheus TDS“…ver, the data extracted by Group-IB’s analysts indicates that a similar pattern is also used to distribute malware such as Campo Loader, IcedID, QBot, SocGholish, and Buer Loader.”
-
REvil Twins: Ransomware-as-a-Service program“Two recent examples are IcedID and Qakbot – both already have a long history of being involved in the ransomware operations.”
-
IcedID: new malware version“IcedID: new malware version”
Indicators in its reports
named in the reports above- exploit[.]inin 2 reports
Copy this indicator · defanged
Thanks — we review every report.